By default, Windows hashes all passwords with what Microsoft calls NThash (sometimes called NTLM hash), which is just MD4 of the UTF-16-LE (little-endian) representation of the password.
Technically, MD4 is a one-way hash, so no, it is not possible to retrieve the password from this. However, the way it's used is very weak, so it's usually possible in practice to reverse the hash.
- Rainbow tables: The passwords are not salted before hashing, so a given password will always product the same NThash on any system. This means they can be pre-computed in giant lookup tables (sorted by hash digest to enable binary search) called "Rainbow Tables". There are many rainbow tables on the web, or you can build your own if you've got a bunch of time to kill. While a rainbow table can never store every possible hash value - MD4 digests are 128 bits long, which means 2^128 possible values, which is quite beyond the capacity of all data storage currently in existence or likely to exist - they can certainly store billions of likely passwords and that makes all but the longest/most obscure passwords crackable in practice.
- Hash brute-forcing programs: Hash algorithms like MD4 are designed to run quickly, and MD4 in particular is nearly 30 years old so you can get tens of thousands of times as much computing power for the same amount of money as you could back then. That means it is possible to compute hashes extremely quickly, especially if you have a processor that is capable of quickly executing the same instructions (the steps of MD4) on multiple data (candidate passwords) in parallel, and collecting the results into one organized output. This (single-instruction-multiple-data or SIMD operation) turns out to be how GPUs work. A single high-end GPU can compute billions of hashes per second, and there are programs that you can run which will use your GPU to try to brute-force a password hash. Even without a rainbow table, you can brute-force most passwords very quickly if you have a good graphics card.
Windows can also be configured in two non-default ways, which would make this task even easier:
- The legacy "LM" or "LANMAN" / "LAN Manager" hashing algorithm makes MD4 look modern and secure. LM hashes can only be used on passwords up to 14 characters in length, and only because the actual operation is performed on pairs of 7-character chunks with the results concatenated. It also only supports a limited set of input characters (notably, it upper-cases the password before hashing). As a result, you can brute-force each half of an LM hash separately and extremely quickly; your typical CPU can brute-force any LM hash in under a minute. LM hashes are disabled by default on all recent versions of Windows (and not used even on older versions like XP if you used a password at least 15 characters long) so you're extremely unlikely to find one on Win10, but I think it's still possible to enable them.
- Windows supports the ability to store passwords under reversible encryption, rather than hashing. This allows any Administrator user to retrieve any user's password, because apparently some of MSFT's customers wanted this ability really badly. It's a terrible idea and should never be enabled, because in addition to letting admins see user passwords, it lets anybody who can access the hard disk and knows how to retrieve the machine key and the encrypted passwords also see the user passwords (and there are tools for this). It's very unlikely that the passwords on any given Windows machine are stored this way, but if they are, then it is in fact possible to directly retrieve them if you have admin-level access to the system or physical access to its system volume.
EDIT: As HackneyB points out in the comments, Microsoft couldn't pass up an opportunity to add some useless obfuscation on top of their antiquated password hash, so they wrap it in multiple layers of futile encryption (futile because the keys are either stored in plain text or derivable from plain text values, so it doesn't matter in the least which ciphers or how many layers are used). Stripping away the obfuscation, though, the only actual cryptographic protection against reversing the passwords is that single-round unsalted MD4 hash.